WRT32x return to factory image

Hi,

I installed OpenWrt v.22.03.0 on a WRT32x, which I recently replaced by another router and now want to reset back to factory to sell it.

Following the procedure mentioned in wiki (https://openwrt.org/toh/linksys/wrt32x#return_to_stock_firmware)

login as: root
Authenticating with public key "router"


BusyBox v1.35.0 (2022-09-22 17:19:43 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 22.03.0, r19685-512e76967f
 -----------------------------------------------------
root@router:~# cd /tmp && sysupgrade -F -n -v FW_WRT32X_1.0.180404.58.im
g
Sun Sep 25 15:08:10 CEST 2022 upgrade: Image metadata not present
Image check failed but --force given - will update anyway!
Sun Sep 25 15:08:10 CEST 2022 upgrade: Commencing upgrade. Closing all shell sessions.
Command failed: Connection failed
root@router:/tmp#

but after reboot I cannot access the alternate partition. When switching back to the partition I did the upgrade from and looking into advanced reboot, I see the following:

I thought maybe the firmware file could be corrupted, but when downloading the file three times, it always had the same checksum (SHA256: 8a5dcaf95e418b86fdb09e5cef264b944bc21863db9728026d70027ee39c19a3), unfortunately Linksys didn’t provide a checksum on their homepage when uploading the file (https://support.linksys.com/kb/article/1030-en/), so maybe they are hosting a corrupt file?

I did this very same process for my WRT1900AC today as well, and for that device it worked without any issue. The only difference I recognized that far is the line `Command failed: Connection failed`, which didn’t appear during WRT1900AC firmware upgrade.

Any idea how to proceed?

Thanks - at least for reading,
ssdnvv

Your sha256 checksum is the same as what I get, so unlikely that Linksys is hosting a corrupt firmware file.

Make sure your WRT32X is connected on your working OpenWrt partition and follow this slightly modified procedure:

cd /tmp

wget https://downloads.linksys.com/downloads/firmware/FW_WRT32X_1.0.180404.58.img

sha256sum FW_WRT32X_1.0.180404.58.img

        '8a5dcaf95e418b86fdb09e5cef264b944bc21863db9728026d70027ee39c19a3  FW_WRT32X_1.0.180404.58.img'

sysupgrade -F -n -v FW_WRT32X_1.0.180404.58.img

If this fails again with similar result returns, show your current environment settings of interest: /usr/sbin/fw_printenv | grep -A2 boot_part=

1 Like

Thanks for comparing! The SHA265sum is the same after upload to the router.

Still silence from my WRT32X, therefore I started Wireshark and it seems there is no server at all on the router side running. My PC is not getting any IPv4/IPv6 via DHCP and those DHCP-requests (and some related stuff) are basically the own messages I can see on the connection.
Tested all 4 LAN ports of the WRT32x + WAN.

Back on working OpenWrt partition:

root@router:~# /usr/sbin/fw_printenv | grep -A2 boot_part=
boot_part=2
boot_part_ready=3
bootargs_dflt=$console $nandEcc $mtdparts_lgcy $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel

edit: I flashed OpenWrt 24.10.4 to partition 1 (maybe something could have been wrong with this partition?) and tried to flash factory image to partition 2, but the behaviour is the same:

login as: root
root@192.168.53.2's password:


BusyBox v1.36.1 (2025-10-19 16:37:45 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 24.10.4, r28959-29397011cc
 -----------------------------------------------------
root@router:~# /usr/sbin/fw_printenv | grep -A2 boot_part=
boot_part=1
boot_part_ready=3
bootargs_dflt=$console $nandEcc $mtdparts_lgcy $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel

It looks from my perspective that the flashing process has been successful.

  • in post one you demonstrate that Linksys firmware was flashed to the alternate partition from 23.05. You were also able to switch back to the current partition (23.05) and access it via ssh.
  • in post three you also demonstrate you were able to flash 24.10 from partition two to partition one as logic dictates, flash Linksys fw to partition two, and access the bOpenWrt partition one successfully.
  • And finally, your boot environment under OpenWrt is correct.

I do though have a question about this:

It appears you may have carried over your config from 23.05 to 24.10? This is fine if you intend to keep the device in service under OpenWrt, but the Linksys firmware sets the router ip to 192.168.1.1. Please verify your laptop -> router connection connects to the 192.168.1.0/24 subnet.

Yes, I checked that many times (with Windows desktop), I even tried a second device (Ubuntu laptop) and on my desktop to listen on the connection with Wireshark. There is no DHCP-server answering the DHCP-requests from my devices and when setting static IPs for the clients (with e.g. 192.168.1.100), 192.168.1.1 cannot be reached.
What is also weird: shouldn’t the Linksys image by default set up two SSIDs, one on 2,4GHz and one on 5GHz and shouldn’t the wireless-LED-symbols light up on the front of the router? This doesn’t happen on my device.
For me it seems like the Linksys installation is somewhat corrupted (no idea how to prove) and thus not active.

Did you try and flash the image on your device? Even if you have the same checksum, this does not necessarily mean the hosted image is intact.

Ok, so here is something really strange happening.

I thought I give it a try and reset the OpenWrt firmware to defaults (I want to sell the device anyways), flash OpenWrt to the alternative partition again and then try again flasing the original image. Now I got this as result:

The partition mentioned above is still there, so the flash process didn’t write to the alternative partition (as descriped in https://openwrt.org/toh/linksys/wrt32x#dual_firmware_flashing) but to the same partition.

Is there a way to debug this further without taking apart the device to access the serial console?

No, I can't flash the image (I have WRT1900ACS/WRT3200ACM only) but using binwalk, I don't believe the image from Linksys is corrupt -->

Binwalk Output

Extracting the image with binwalk -B FW_WRT32X_1.0.180404.58.img produces:

_FW_WRT32X_1.0.180404.58.img.extracted. 

Decending into __FW_WRT32X_1.0.180404.58.img.extracted we find:

-rw-rw-r--  1 drdeth drdeth 10741760 Nov 18 08:46 0.tar
drwxr-xr-x  2 drdeth drdeth     4096 Nov  4  2017 sysupgrade-armada-385-linksys-venom

and running tar -tvf 0.tar returns:

-rw-r--r-- jenkins/jenkins  31 2017-11-04 17:15 sysupgrade-armada-385-linksys-venom/CONTROL
-rw-r--r-- jenkins/jenkins 8650756 2017-11-04 17:15 sysupgrade-armada-385-linksys-venom/root
-rwxr-xr-x jenkins/jenkins 2076997 2017-11-04 17:15 sysupgrade-armada-385-linksys-venom/kernel

Running binwalk -B sysupgrade-armada-385-linksys-venom/root returns:

CIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, version 4.0, compression:xz, size: 8546452 bytes, 1710 inodes, blocksize: 262144 bytes, created: 2017-11-04 21:15:13

Running binwalk -B sysupgrade-armada-385-linksys-venom/kernel returns:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Linux kernel ARM boot executable zImage (little-endian)
23356         0x5B3C          xz compressed data
23724         0x5CAC          xz compressed data
2058728       0x1F69E8        Flattened device tree, size: 18269 bytes, version: 17
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

and finally cat CONTROL returns:

BOARD=armada-385-linksys-venom

This seems consistent to the platform.

Grasping at straws here at this point. You could try flashing a WRT32X factory.img from https://downloads.openwrt.org/releases/24.10.4/targets/mvebu/cortexa9/openwrt-24.10.4-mvebu-cortexa9-linksys_wrt32x-squashfs-factory.img

This should put the image on Partition 2. If it boots properly to Partition 2, flash a 24.10.4 sysupgrade.bin from https://downloads.openwrt.org/releases/24.10.4/targets/mvebu/cortexa9/openwrt-24.10.4-mvebu-cortexa9-linksys_wrt32x-squashfs-sysupgrade.bin to Partition 1.

This should recreate your boot environment. See if you can boot freely between the two different partitions to rule out any flash fault.

The following is specific for the WRT32x device:

There was a kernel partition resize change somewhere around v21 or v23 (cant remember) of OpenWRT.

The vendor firmware development stopped long ago during v17 and the old vendor firmware can’t deal with the OpenWRT caused kernel partition size change.

You need to flash e.g OpenWRT v18, v19 factory, not sysupgrade! (any version before the partition change will do). And then you should be able to flash back the vendor firmware of Linksys.

(And I still don’t get, why people make the effort return to the 8 year old buggy WRT vendor firmware, instead of selling it with recent OpenWRT :slightly_smiling_face: )

Add on: v23 or v24 (?) had a WRT32X bug, where the partition did not alternate during OpenWRT flash. Not sure, if this also plays a role here.

1 Like

That was this commit: https://github.com/openwrt/openwrt/pull/3852
I'm pretty sure it was merged into v21. I don't recall there was an issue trying to return to OEM though.

Fixed on: https://github.com/openwrt/openwrt/pull/16690
So flashing v24.x factory first, and then sysupgrade to the other partition should resolve that issue.

1 Like

Good point, I guess it is the “vanilla”-condition one (and least I) want to recreate.

Does that apply to WRT1900AC as well? On that device I had a quite old OpenWrt firmware (20.x or 21.x, don't remember well) and flashing worked straight away.

as far as I remember, only the WRT32X had too small vendor-default kernel partitions.

1 Like

Yes. Both Mamba (WRT190AC) and Venom (WRT32X) had kernel resize changes at the same time. (Increasing mamba and venom kernel partition to 6MB).

1 Like

Flashing 24.10.4 factory didn’t help, it only changes the partition order:

But 19.07.9 was the right decision:

I flashed this on second partition as well and now (starting with the old partition size) restoring the old WRT32X-image worked:

Thanks alot to both of you for your help!

One last question (out of curiousity): Why did I have to use the OpenWrt factory image first - does this image type allow changing partition layouts?

yes, but note that is specific topic for this device, starting with v21 or 23 comes with a changed partition schema. The sysupgrade image does not change the partition sizes.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.